For the Love of Money - Finding and Exploiting Vulnerabilities in Mobile Point of Sales Systems
Explore security vulnerabilities in mobile payment systems, focusing on economic implications, fraud risks, and outdated card standards. Learn about testing methods and potential attack vectors.
It's a PHP Unserialization Vulnerability Jim, but Not as We Know It
Explore PHP unserialization vulnerabilities, including RCE exploits in popular web applications. Learn attack methodologies, file formats, and defense strategies.
An Attacker Looks at Docker - Approaching Multi-Container Applications
Explore containerization's impact on offensive security operations, focusing on Docker's implications for penetration testing and multi-container application vulnerabilities.
Devils Are in the File Descriptors - It Is Time To Catch Them All
Explore vulnerabilities in Linux kernel file descriptor operations, focusing on high-risk scenarios in exporting and importing, and learn to identify and address these security concerns.
ELF Section Docking - Revisiting Stageless Payload Delivery
Explore advanced techniques for embedding and loading static payloads in Linux malware, focusing on ELF binary construction and section manipulation to enhance payload survival and evasion.
How Supercomputer-Scale Neural Network Models Apply to Defensive Cybersecurity Problems
Explore how large-scale neural networks revolutionize cybersecurity, enabling custom explanations of attacker behavior and improved threat detection with limited data. Learn to leverage public models like GPT-3 for security applications.
Demystifying Key Stretching and PAKEs
Explore key stretching and PAKEs: their history, best practices, and applications in encrypted cloud services. Learn to create toy algorithms and understand their importance in cybersecurity.
DNSSEC Downgrade Attacks
Explore DNSSEC vulnerabilities and cryptographic agility risks, revealing how adversaries can manipulate DNS responses to compromise security and prevent DNSSEC validation.
The Battle Against the Billion-Scale Internet Underground Industry - Advertising Fraud Detection
Explore the escalating war between internet advertising fraud and anti-fraud efforts. Analyze typical underground industry gangs and their evolving tactics in this high-stakes technological confrontation.
Trying to Be Everything to Everyone - Let’s Talk About Burnout
Explore burnout in computer security, its causes, and mitigation strategies. Learn to set boundaries, manage anxiety, and maintain passion in a high-stress industry facing significant workforce shortages.
From Hackathon to Hacked - Web3's Security Journey
Explore Web3 and blockchain security challenges, examining the risks of emerging tech, high-stakes environments, and immutable transactions. Learn about current vulnerabilities and potential solutions.
Dive Into Apple IO80211Family Vol. 2
Explore Apple's Wi-Fi kernel extensions, uncovering new vulnerabilities and attack surfaces in the ever-evolving landscape of iOS security. Gain insights into the ongoing cat-and-mouse game of bug fixes and emerging threats.
Charged by an Elephant - An APT Fabricating Evidence to Throw You in Jail
Explore ModifiedElephant's decade-long operation, incriminating activists through planted evidence. Uncover the concerning ties to commercial surveillance and multiple regional threat actors targeting victims.
Fault-Injection Detection Circuits - Design, Calibration, Validation and Tuning
Explores Intel's tunable replica circuit for detecting fault-injection attacks in processors, focusing on design, implementation, and effectiveness in preventing timing failures and unauthorized code execution.
The Cyber Safety Review Board - Studying Incidents to Drive Systemic Change
Explore the Cyber Safety Review Board's analysis of the Log4j vulnerability, key findings, and recommendations for industry and government to enhance cybersecurity and drive systemic change.
EBPF ELFs JMPing Through the Windows
Explore eBPF for Windows: capabilities, security model, design, and attack surface. Uncover vulnerabilities, witness fuzzing demos, and discuss exploitation challenges in Windows Protected Process.
Backdoor Investigation and Incident Response - From Zero to Profit
Uncover how attackers breached an online gaming company, exploited a database backdoor, and manipulated transactions. Learn detection methods and incident response strategies for similar cyber attacks.
Codema Attack - Controlling Your Smart Home Through Dangling Management Channels
Análisis de vulnerabilidades en dispositivos IoT populares y desarrollo de CGuard, un nuevo marco de control de acceso para proteger a los usuarios finales de amenazas en canales de gestión.
SMS PVA Services Fueled by Compromised Supply-Chain Mobile Botnets
Uncover the operations of SMS PVA services and mobile botnets, exploring device infection methods, threat actor misuse, and the implications for supply chain security in mobile ecosystems.
Cooper Knows the Shortest Stave - Finding 134 Bugs in the Binding Code of Scripting Languages
Innovative approach to finding bugs in scripting languages through cooperative mutation, combining script code and native input modifications to uncover hidden vulnerabilities in binding code.
DroidGuard - A Deep Dive into SafetyNet
Explore SafetyNet's internal mechanisms, VM design, and security checks for detecting Magisk, emulators, rooted devices, and Pegasus in this comprehensive analysis of DroidGuard.